I'm helping a nonprofit that handles sensitive medical information and currently hosts its email on-premises. They have fewer than 10 users and are considering upgrading from Exchange 2016. Microsoft's guidance appears to increase the mailbox server requirement from around 8 GB to as much as 128 GB, which seems excessive for such a small organization. Is that requirement based on real-world needs, or does it mainly encourage organizations to move to hosted services? What is a realistic minimum amount of RAM for a small deployment?
Some national and regional rules in Italy impose strict requirements around data location, separation, and third-party processing of medical information, so moving to a cloud service may not be straightforward. We're reviewing those requirements, but I'd like to understand the practical on-premises sizing options as well.
4 Answers
For fewer than 10 users, Exchange can run with substantially less than the maximum published specification, but the official sizing guidance should still be treated as the safe baseline. Around 32 GB may be workable for a lightly used installation, provided the server has adequate CPU, storage performance, and free disk space. Keep a healthy amount of storage available—running close to full can cause serious problems.
Be careful about planning around Exchange 2019. It has reached the end of its normal support life, and the current on-premises product is Exchange Server Subscription Edition. Check the licensing, support, and upgrade path before buying or deploying anything.
Use Microsoft’s Exchange sizing calculator rather than relying only on the headline RAM number. A small organization may not need 128 GB in practice, but the server still needs enough memory for the operating system, Exchange services, indexing, updates, and maintenance tasks. I’ve seen small deployments run comfortably with 64 GB, while 32 GB can be sufficient when the workload is very light.
It’s worth investigating hosted Microsoft 365 before committing to on-premises Exchange. For a tiny organization, managed mail filtering, backups, security controls, and compliance features can be difficult and expensive to reproduce locally. That said, data-residency and medical-data rules vary by country and by partner agreement, so the organization should have its legal or compliance adviser confirm whether the service and its specific configuration are acceptable.
We’re based in Italy, where additional rules can apply to medical data, including separation requirements and restrictions on third-party processing. I’m checking whether nonprofit licensing and a properly configured hosted tenant would satisfy those obligations, but I’m not ready to assume that it will.